#!/usr/bin/env bash

source ./config/env.sh
clear

mkdir -p ${K8S_CA_DIR}/controllerManager

cat > ${K8S_CA_DIR}/controllerManager/kube-controller-manager-csr.json <<EOF
{
    "CN": "system:kube-controller-manager",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "hosts": [
      "127.0.0.1",
    ],
    "names": [
      {
        "C": "CN",
        "ST": "BeiJing",
        "L": "BeiJing",
        "O": "system:kube-controller-manager",
        "OU": "4Paradigm"
      }
    ]
}
EOF


sed -i '9 i\ \ \ \ \ \ "'`echo ${MASTER_IP} |  cut -d " " -f 1`'"' ${K8S_CA_DIR}/controllerManager/kube-controller-manager-csr.json
for ((i=2; $i<=${MASTER}; i++))
do
  sed -i '9 i\ \ \ \ \ \ "'`echo ${MASTER_IP} |  cut -d " " -f $i`'",' ${K8S_CA_DIR}/controllerManager/kube-controller-manager-csr.json
done

cd ${K8S_CA_DIR}/controllerManager

cfssl gencert -ca=${K8S_CA_DIR}/admin/ca.pem \
    -ca-key=${K8S_CA_DIR}/admin/ca-key.pem \
    -config=${K8S_CA_DIR}/admin/ca-config.json \
    -profile=kubernetes kube-controller-manager-csr.json | cfssljson -bare kube-controller-manager

for master_ip in ${MASTER_IP}
do
  echo "=========================================== ${master_ip} ==========================================="
  ssh root@${master_ip} "test -e ${K8S_CA_DIR}/controllerManager || mkdir -p ${K8S_CA_DIR}/controllerManager"
  scp ${K8S_CA_DIR}/controllerManager/kube-controller-manager*.pem root@${master_ip}:${K8S_CA_DIR}/controllerManager
done


${K8S_BIN_DIR}/kubectl config set-cluster kubernetes \
  --certificate-authority=${K8S_CA_DIR}/admin/ca.pem \
  --embed-certs=true \
  --server=${APISERVER} \
  --kubeconfig=kube-controller-manager.kubeconfig

${K8S_BIN_DIR}/kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=${K8S_CA_DIR}/controllerManager/kube-controller-manager.pem \
  --client-key=${K8S_CA_DIR}/controllerManager/kube-controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-controller-manager.kubeconfig

${K8S_BIN_DIR}/kubectl config set-context system:kube-controller-manager \
  --cluster=kubernetes \
  --user=system:kube-controller-manager \
  --kubeconfig=kube-controller-manager.kubeconfig

${K8S_BIN_DIR}/kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig

for master_ip in ${MASTER_IP}
do
  echo "=========================================== ${master_ip} ==========================================="
  scp ${K8S_CA_DIR}/controllerManager/kube-controller-manager.kubeconfig root@${master_ip}:${K8S_CA_DIR}/controllerManager
done

mkdir -p ${K8S_DATA}/config/controllerManager

cat > ${K8S_DATA}/config/controllerManager/kube-controller-manager.service <<EOF
[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
WorkingDirectory=${K8S_DATA}/data/controllerManager
ExecStart=${K8S_BIN_DIR}/kube-controller-manager \\
  --kubeconfig=${K8S_CA_DIR}/controllerManager/kube-controller-manager.kubeconfig \\
  --authentication-kubeconfig=${K8S_CA_DIR}/controllerManager/kube-controller-manager.kubeconfig \\
  --authorization-kubeconfig=${K8S_CA_DIR}/controllerManager/kube-controller-manager.kubeconfig \\
  --service-cluster-ip-range=${SERVICE_CIDR} \\
  --cluster-name=kubernetes \\
  --cluster-signing-cert-file=${K8S_CA_DIR}/admin/ca.pem \\
  --cluster-signing-key-file=${K8S_CA_DIR}/admin/ca-key.pem \\
  --experimental-cluster-signing-duration=8760h \\
  --root-ca-file=${K8S_CA_DIR}/admin/ca.pem \\
  --service-account-private-key-file=${K8S_CA_DIR}/admin/ca-key.pem \\
  --leader-elect=true \\
  --controllers=*,bootstrapsigner,tokencleaner \\
  --horizontal-pod-autoscaler-use-rest-clients=true \\
  --horizontal-pod-autoscaler-sync-period=10s \\
  --tls-cert-file=${K8S_CA_DIR}/controllerManager/kube-controller-manager.pem \\
  --tls-private-key-file=${K8S_CA_DIR}/controllerManager/kube-controller-manager-key.pem \\
  --use-service-account-credentials=true \\
  --kube-api-qps=1000 \\
  --kube-api-burst=2000 \\
  --logtostderr=true \\
  --v=2
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

${K8S_BIN_DIR}/kubectl create clusterrolebinding controller-manager:system:auth-delegator --user system:kube-controller-manager --clusterrole system:auth-delegator

#start
for master_ip in ${MASTER_IP}
do
  echo "=========================================== ${master_ip} ==========================================="
  ssh root@${master_ip} "test -e ${K8S_DATA}/data/controllerManager || mkdir -p ${K8S_DATA}/data/controllerManager"
  scp ${K8S_DATA}/config/controllerManager/kube-controller-manager.service root@${master_ip}:/etc/systemd/system/
  ssh root@${master_ip} "systemctl daemon-reload && systemctl enable kube-controller-manager && systemctl start kube-controller-manager"
done

sleep 10
for master_ip in ${MASTER_IP}
do
  echo "=========================================== ${master_ip} ==========================================="
  ssh root@${master_ip} "systemctl restart kube-controller-manager"
done

sleep 10
#check
for master_ip in ${MASTER_IP}
do
  echo "=========================================== ${master_ip} ==========================================="
  ssh root@${master_ip} "systemctl status kube-controller-manager|grep Active"
done


sleep 10
curl --cacert ${K8S_CA_DIR}/admin/ca.pem --cert ${K8S_CA_DIR}/kubectl/admin.pem --key ${K8S_CA_DIR}/kubectl/admin-key.pem https://127.0.0.1:10252/metrics

echo "=========================================== ${master_ip} ==========================================="
${K8S_BIN_DIR}/kubectl get endpoints kube-controller-manager --namespace=kube-system  -o yaml
